Plack::Middleware::XSendfile versions through 1.0053 allow clients to control the sendfile type via the X-Sendfile-Type header if not properly restricted in the middleware constructor or environment. Specifically, attackers can set this header to "X-Accel-Redirect" and use the X-Accel-Mapping header to rewrite paths, enabling access to arbitrary files on servers behind nginx reverse proxies. Although some mitigations exist (disallowing regex in mappings and limiting application to "X-Accel-Redirect" type), the vulnerability still permits exposure of sensitive information. The middleware is deprecated and slated for removal in future Plack releases. This vulnerability is similar to CVE-2025-61780 affecting Rack::Sendfile.

Successful exploitation allows an attacker to read arbitrary files on the server by manipulating path mappings, leading to exposure of sensitive information. The vulnerability does not affect integrity or availability but has a high confidentiality impact. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Since Plack::Middleware::XSendfile is deprecated as of version 1.0053 and planned for removal, users are advised to migrate away from this middleware to alternative, secure methods for handling sendfile functionality. Until then, restrict or validate client-controlled headers such as X-Sendfile-Type and X-Accel-Mapping to prevent unauthorized path rewriting. Monitor vendor advisories for updates or official remediation.